Views:
Use the following log types for SMS message logging.
SMS System
Field Type Max size Description
facility integer 11 Appears to always be 0
formattedTime date string 15 MMM dd HH:mm:ss, ex. Mar 20 02:02:48
logID long 20 SMS system log entry identifier
message string 1024 System log message
severity integer 4
Severity of the entry:
1,2 – Info
3 - Warn
4 – Error
5 - Critical
time long 20 System log entry timestamp in milliseconds
SMS Audit
Field Type Max size Description
clientIpAddress String 39 Source address of the client that generated the audit entry.
clientPort Integer 11 Port of the client that generated the audit entry.
description String 1024 Audit message.
index Long 20 SMS audit log entry identifier.
sessionID Integer 11 SMS identifier for the user session that generated the audit entry.
status String 300 Success, fail
time Long 20 Audit log entry timestamp in milliseconds.
userName String 150 Name of the user.
Device System
Field Type Max size Description
component String 12 Component area of the device that generated the system log entry.
deviceID Integer 10 SMS identifier for the device.
deviceName String 63 User-provided name of the device that system log entry was received from.
index Long 20 SMS device system log entry identifier.
message String 65.535 System message.
messageCode Long 10
sequence Long 20 Device system log entry identifier.
severity String 32 INFO, WARN, ERR
time Long 20 System log entry timestamp in milliseconds.
Device Audit
Field Type Max size Description
accessLevel string 13 Unknown, Operator, Administrator, Super User, SMS
component string 12 Component area of the device that generated the audit entry
deviceID integer 10 SMS identifier for the device
deviceName string 63 User-provided name of the device that audit entry was received from
index Long 20 SMS device audit entry identifier
interface string 7 Device interface type that initiated the audit entry
ipAddress IP Address 39 Source address of the interface that generated the audit entry
message string 65,535 Audit message
result String 4 PASS, FAIL
sequence Long 20 Device audit entry identifier
time Long 20 Audit entry timestamp in milliseconds
user String 128 Name of the user
Snort Syslog Format MARS [Deprecated]
Column Description
0 Date (timestamp)
1 Device identifier
2 SID
3 Filter name
4 Classification
5 Priority
6 Protocol (TCP, UDP, ICMP, and IP)
7 Source address
8 –> (indicates direction of traffic flow: source –> destination)
9 Destination address
Snort Syslog Format V2 [Deprecated]
Column Description
0 Device identifier
1 SID
2 Filter name
3 Classification
4 Priority
5 Protocol
6 Source address
7 –>
8 Destination address
SMS 2.0/2.1 Syslog Format
Column Description
0 Syslog category — “<32>” — defined facility and severity
1 Action type — 7 is Permit, 8 is Block, 9 is P2P
2 Severity — 0 is Normal, 1 is Low, 2 is Minor, 4 is Critical
3 Policy UUID — TippingPoint UUID for policy
4 Signature UUID — TippingPoint UUID for signature
5 Signature name — user-friendly name for signature and policy
6 Signature number
7 Signature protocol — protocol of signature (IP, UDP, TCP, HTTP, etc.)
8 Source address
9 Source port
10 Destination address
11 Destination port
12 Hit count — number of attacks during aggregation period
13 Device slot — this slot can be 3,5,7,8
14 Device segment — device segment of above slot that got event
15 Device name — user-friendly name of the device event was received
16 TippingPoint Taxonomy ID — category ID assigned to the signature
17 Event timestamp in milliseconds
18 Additional comments about the event
19 Sequence number of the event in the SMS
SMS 2.5 Syslog Format
Column Description
0 Syslog category — “<32>” — defined facility, and the severity
1 Action type — 7 is Permit, 8 is Block, 9 is P2P
2 Severity — 0 is Normal, 1 is Low, 2 is Minor, 3 is Major, 4 is Critical
3 Policy UUID — TippingPoint UUID for policy
4 Signature UUID — TippingPoint UUID for signature
5 Signature name — user-friendly name for signature and policy
6 Signature number
7 Signature protocol — protocol of signature (IP, UDP, TCP, HTTP, etc.)
8 Source address
9 Source port
10 Destination address
11 Destination port
12 Hit count
13 Source zone name
14 Destination zone name
15 Incoming physical port
16 VLAN ID
17 Device name — user-friendly name of the device event was received
18 TippingPoint taxonomy ID — category ID assigned to signature
19 Event timestamp in milliseconds
20 Additional comments about the event
21 Sequence number of the event in the SMS
ArcSight CEF Format v3.5 [Deprecated]
Use this format type to send events to an ArcSight connector. This format type does not support IPv6.
Column CEF key name Description
0 CEF CEF header (Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|)
1 app Application protocol
2 cnt Base event count
3 dst Destination address
4 dpt Destination port
5 act Device action
6 cn1 Device custom number 1: VLAN tag
7 cn1Label Device custom number 1 label
8 cn2 Device custom Number 2: taxonomy ID
9 cn2Label Device custom number 2 label
10 cn3 Device custom number 3: packet trace
11 cn3Label Device custom number 3 label
12 cs1 Device custom string 1: profile name
13 cs1Label Device custom string 1 label
14 cs2 Device custom string 2: policy UUID
15 cs2Label Device custom string 2 label
16 cs3 Device custom string 3: signature UUID
17 cs3Label Device custom string 3 label
18 cs4 Device custom string 4: zone names
19 cs4Label Device custom string 4 label
20 cs5 Device custom string 5: device name
21 cs5Label Device custom string 5 label
22 cs6 Device custom String 6: message parameters (IP address of Reputation filter matches)
23 cs6Label Device custom string 6 label
24 src Source address
25 spt Source port
26 externalID External ID (event ID)
27 rt Event time
28 cat Device event category
29 proto Transport protocol
30 deviceInboundInterface Device inbound interface (physical port in)
ArcSight CEF Format v4.1 [Deprecated]
Use this format type to send events to an ArcSight connector. This format type includes HTTP context information and supports IPv6.
Column CEF key name Description
0 CEF CEF header (Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|)
1 app Application protocol
2 cnt Base event count
3 dst Destination IPv4 address
4 dpt Destination port
5 act Device action
6 cn1 Device custom number 1: VLAN tag
7 cn1Label Device custom number 1 label
8 cn2 Device custom number 2: taxonomy ID
9 cn2Label Device custom number 2 label
10 cn3 Device custom number 3: packet trace
11 cn3Label Device custom number 3 label
12 cs1 Device custom string 1: profile name
13 cs1Label Device custom string 1 label
14 cs2 Device custom string 2: policy UUID
15 cs2Label Device custom string 2 label
16 cs3 Device custom string 3: signature UUID
17 cs3Label Device custom string 3 label
18 cs4 Device custom string 4: zone names
19 cs4Label Device custom string 4 label
20 cs5 Device custom string 5: device name
21 cs5Label Device custom string 5 label
22 cs6 Device custom string 6: message parameters (IP address of Reputation filter matches)
23 cs6Label Device custom string 6 label
24 src Source IPv4 address
25 spt Source port
26 externalID External ID (event ID)
27 rt Event time
28 cat Device event category
29 proto Transport protocol
30 deviceInboundInterface Device inbound interface (physical port in)
31 c6a2 Source IPv6 address
32 c6a3 Destination IPv6 address
33 request URI string
34 requestMethod URI method
35 dhost URI host
ArcSight CEF Format v4.2
Use this recommended format type to send events to an ArcSight connector. This format type includes HTTP context information, TCIP/XFF client IP, and user information.
Column CEF key name Description
0 CEF CEF header (Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|)
1 app Application protocol
2 act Flow control of the filter
3 c6a1 Client IPv6 address
4 c6a1Label Client IPv6 address field label
5 c6a2 Source IPv6 address
6 c6a2Label Source IPv6 address field label
7 c6a3 Destination IPv6 address
8 c6a3Label Destination IPv6 address field label
9 cat Filter name category
10 cn1 Device custom number 1: VLAN ID
11 cn1Label Device custom number 1 label
12 cn2 Device custom number 2: taxonomy ID
13 cn2Label Device custom number 2 label
14 cn3 Device custom number 3: packet trace
15 cn3Label Device custom number 3 label
16 cs1 Device custom string 1: profile name
17 cs1Label Device custom string 1 label
18 cs2 Device custom string 2: profile UUID
19 cs2Label Device custom string 2 label
20 cs3 Device custom string 3: filter signature UUID
21 cs3Label Device custom string 3 label
22 cs4 Device custom string 4: zone names (source and destination)
23 cs4Label Device custom string 4 label
24 cs5 Device custom string 5: device name
25 cs5Label Device custom string 5 label
26 cs6 Device custom string 6: filter message parameters (IP address of Reputation filter matches)
27 cs6Label Device custom string 6 label
28 cnt Event hit count
29 deviceInboundInterface Physical port in
30 dhost Host name of the URI
31 dntdom Destination domain name
32 dpt Destination port
33 dst Destination IPv4 address
34 duser Destination username
35 dvchost Device name
36 externalId Event ID
37 proto Network protocol
38 request URI string
39 requestMethod URI method
40 rt Event time stamp
41 sntdom Source domain name
42 sourceTranslatedAddress Client IPv4 address
43 spt Source port
44 src Source IPv4 address
45 suser Source user name